EudorIACyber Intelligence
Operational monitoring Newsletter IT EN
← Back to intelligence
Ransomware

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

Official source
EudorIA operational summary

What it means

Priority 95/100

CISA Cybersecurity Advisories ha pubblicato un advisory sul ransomware Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. La fonte descrive vulnerabilita o tecniche gia osservate in attacchi e richiede una verifica prioritaria.

Why it matters

L'advisory descrive attivita ransomware osservate e misure difensive pubblicate da un'autorita. Non prova che il proprio perimetro sia compromesso, ma richiede una verifica prioritaria di esposizione e controlli.

Recommended actions

  1. Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.
  2. Verificare sistemi esposti, accessi remoti e versioni rispetto all'advisory ufficiale.
  3. Confermare che backup offline e immutabili siano separati e ripristinabili.
  4. Correlare TTP e IOC pubblicati con la telemetria autorizzata del proprio perimetro.

Potential operational benefits

  • Prioritizzazione delle esposizioni Internet e delle vulnerabilita sfruttate
  • Verifica dei controlli su accessi remoti, movimento laterale ed esfiltrazione
  • Validazione documentata della capacita di ripristino
Indications to confirm against the customer's technical and organisational perimeter.
Relevant controlsVulnerability managementIdentity and access managementNetwork segmentationBackup and recoveryDetection and response
AudienceITSOCCISOManagement
Information centre

Translation in progress

CISA

The official content is available in the original language. The Italian version will be published once automated checks are complete.

Text acquired from the source

Cybersecurity Advisory Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure Last Revised July 22, 2026 Alert Code AA26-097A Related topics: Cybersecurity Best Practices , Critical Infrastructure Security and Resilience , Cyber Threats and Response Advisory at a Glance Title Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure Original Publication April 7, 2026 Last Update July 22, 2026 Executive Summary The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs). These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss. Last Update Description This update adds new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs. It also expands scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practices for secure deployment. Affected Products Potentially all internet exposed PLCs, including Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and other branded/manufactured PLCs. Key Actions Install PLCs consistent with manufacturers' guidelines and security best practices. Remove PLCs from direct internet exposure via secure gateway and firewall; work with IT/OT team member

Indicatori CISA verificabili

21 valori IOC dalla fonte ufficiale. Non sono una lista di blocco automatica: verificare data, contesto e applicabilita.

Copertura parziale: sono mostrati solo gli indicatori verificati e interpretabili. 1 allegati richiedono ancora verifica o un formato supportato.

Ultima verifica: 2026-09-26T06:31:11.692495+00:00

Scarica STIX 2.1
TipoIndicatore (non cliccabile)File
ipv4-addr88[.]80[.]150[.]202
ipv4-addr88[.]80[.]150[.]200
ipv4-addr88[.]80[.]150[.]199
ipv4-addr141[.]11[.]164[.]153
ipv4-addr185[.]225[.]17[.]225
ipv4-addr84[.]200[.]205[.]165
ipv4-addr192[.]142[.]54[.]79
ipv4-addr185[.]82[.]73[.]175
ipv4-addr175[.]110[.]121[.]107
ipv4-addr175[.]110[.]121[.]41
ipv4-addr175[.]110[.]121[.]42
ipv4-addr175[.]110[.]121[.]39
ipv4-addr185[.]82[.]73[.]168
ipv4-addr135[.]136[.]1[.]133
ipv4-addr185[.]82[.]73[.]162
ipv4-addr185[.]82[.]73[.]170
ipv4-addr185[.]82[.]73[.]167
ipv4-addr185[.]82[.]73[.]171
ipv4-addr185[.]82[.]73[.]165
ipv4-addr185[.]82[.]73[.]164
ipv4-addr79[.]133[.]46[.]209

Provenance

Allegato ufficiale CISA · 2026-07-21T16:23:45Z

SHA-512: cf3e46767cabac95a862939b203c8c827e023557d4ae3e0a8b5bf3bd311ee36ba8fb59c7b923e5d3ef40a89944cc86258fcdbe15cdcb12275e889416c1b092f3

Source
CISA Cybersecurity Advisories
Publishing entity
CISA
Entity type
National authority
Area
North America · US
Original language
en · translation in preparation
Publication
22/07/2026 14:00
Sharing
TLP:CLEAR
MITRE ATT&CK
T0883, T0885, T1041, T1219, T1565
Classification
Critical
Stated country
US

Action indicated by the source

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.

Official technical references

Open the original source